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Measures 
« a : a 5 S z 
Efficient and timely delivery of our services for We will assess and respond to 80% of Data Protection concerns Goal 1 Charter Performance 26.5% 33.4% 39.3% 32.6% 32.8% 
individuals and organisations within 90 days Measure Measure 
F Pi F 
We will assess and respond to 90% of Data Protection concerns Goal 1 Charter Performance 89.4% 93.6% 94.0% 92.4% 92.3% 
within 6 months Measure Measure 
x i ` 4 
Less than 1% of our Data Protection complaints caseload will be Goal 1 Performance 1.24% 1.47% 1.28% 1.26% 1.26% 
over 12 months old Measure 
We will resolve 80% of written enquiries within 7 calendar days Charter Performance a 9 a r 9» 
(Combined measure of Public and Business Advice enquiries) Goal 2 Measure Measure 47:6% 79.1% 238A 76:8% 98:0% 
4 5 : T 
We will resolve 99% of written enquiries within 30 calendar days Goal 2 Charter Performance 70.9% 94.4% 95.6% 96.4% 87.6% 
(Combined measure of Public and Business Advice enquiries) Measure Measure 
We will answer 80% of calls and live chats within 60 seconds Charter Performance ù 6 a 72% 
(Combined measure of calls and live chats) cot Measure Measure New for Q2 ne 78%, 732 (Q2-Q4) 
In 100% of cases, the Parliamentary and Health Service Performance a 6) a Fy 
Ombudsman (PHSO) do not uphold a complaint about the ICO Seals Measure Oe GON He Mole He 
We will investigate and respond to 90% of service complaints Charter Pértormance 
within 30 calendar days Goal 1 Measure Measure 64.1% 58.6% 80.4% 71.4% 68.0% 
(Combined measure of service complaints across all teams) 
Customer satisfaction score Goal 4 Pelrormance || Annual Annual 69.4 Annual 69.4 
Measure measure measure measure 


RAG Status 


Q4 Q4 Comments 


This casework target reflects part of our ambition to get to, and 
resolve, complaints as soon as they arrive with the ICO. Whilst this 
remains a challenge, and the volumes of cases we can conclude 
within 12 weeks of arrival is not as we would want, we are making 
progress every month to allocate quicker - currently at around the 
10-11 week mark - and reduce the overall work in hand. We 
anticipate delivery against this performance indicator at the end of 
Q2 in 2022/23, but expect improvement against reported 
percentages in months ahead. 


Since Q2 of 2021/22, we have been able to assess and respond to 
90% of data protection concerns within 6 months. We are now in a 
position where this Key Performance Indicator (KPI) is consistently 
being exceeded and as such we are now focused on improving our 
timeliness further, as we aspire to deal with 80% of cases within 90 
days. 


We have a number of older cases that we expect to resolve 
imminently and continue to keep all of casework over a year old 
under close review. 


74.4% of Public Advice enquiries were resolved within 7 calendar 
days during Q4 (1,190 out of 1,599), and 83.4% of Business 
Advice enquiries were resolved within 7 calendar days (476 out of 
571). Across the full year, 80.8% of Business Advice enquiries 
were resolved within 7 calendar days, and 63.3% of Public Advice 
enquiries. 


Further improvement during Q4, where 2,091 of 2,170 cases were 
resolved within 30 calendar days. 


Continued improvement during Q4, falling just slightly below target 
at 79.48% as a combined figure. Across Q4 we sustained strong 
performance on live chats answered within 60 seconds (88%), and 
helpline calls answered within 60 seconds (78% compared to 58% 
at Q2). In total 86,683 calls were answered during the quarter; 
75,518 helpline calls and 11,165 live chats. 

As a new measure introduced in-year, our overall outturn of 72% 
reflects only quarters 2 to 4, and was impacted by our performance 
during Q2. 


Across 2021/22 we received 47 PHSO complaints (12 in Q1; 9 in 
Q2; 13 in Q3; 13 in Q4), of which 1 was upheld in Q2. Our outturn 
performance is therefore 98% (46 out of 47 not upheld). 


In Q4, 75 out of 105 service complaints were investigated and 
responded to within 30 calendar days. In total across 2021/22, 
293 out of 430 complaints were investigated and responded to 
within the 30 days. 

The ICO is committed to improving this area of work so that our 
customers receive a response to service complaints within 30 days. 
This will be an area of focus for Q1 in 2022/23. 


The overall ICO Customer Satisfaction Index (CSI) is 69.4, with 
Not Applicable | satisfaction at 60.4 for our Public Services and 80.7 for Business 
Services. We have an overall CSI ambition for 2022/23 of 72.4 
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In line with our recovery plan, performance improved again during 


i j ai 
We ‘will refer: or ‘close 80% of personal data:bteachireports within Goal 5 Charter Performance 54% 29% 65% 74% 54% Q4, though overall 2021/22 outturn was impacted by performance 
30 days Measure Measure Beaks 
shortfalls earlier in the year. 
jj s 
Less than 1% personal data breach reports will be over 12 months Goal 5 Performance <1% <1% 0% <1% <1% Only 1 out of 900 plus personal data breach reports was over 12 
old Measure months at the end of 2021/22. 
This KPI will remain outside its target in the coming months as a 
result of complaint casework queue becoming older. A recovery 
Less than 1% of our Freedom of Information caseload will be over Goal 1 Performance 4.22% 3.28% 5.16% 6.62% 6.62% Red plan is being implemented and we will gradually see this reduce 
12 months old Measure once the new staff are recruited, trained and productive, as we 
make efficiencies, and as we reduce the wider queue (see 
mitigation below). 
Our productivity has returned to pre-pandemic levels and we have 
broadly kept pace with the new level of demand. A recovery plan 
based on efficiencies, streaming work, more earlier resolution, 
sharing learning to support public authorities to get it right first 
P ect time, more upstream intervention and a number of temporary staff 
9 n 
Wai Reeth NGS andre pond ro Beha eis ASSET Cit Goal 1 Gheior aier rmance || a cp, 72.67% 73.33% 66.76% 71.73% Red is being implemented to initially reduce the backlog down to pre- 
Information concerns within 6 months Measure Measure 


pandemic levels by end of the business year. We then want to drive 
the performance further to improve service overall before returning 
the additional temporary resources. The Director will present a 
more detailed paper and recovery plan to Management Board at 
the July meeting. 


68 First-Tier Tribunal cases were closed in Q4, of which 49 were 
successfully defended (NB: ‘Successfully defended’ is outcomes 
other than ‘Allowed’, 'Part-Allowed' and 'Consent Order’). 

We have had a large number of record closures updated, and in 


66% of Freedom of Information tribunal hearings in our favour Goal 4 et a 72% 73% 76% 72% 73% most cases these were backdated due to tribunal and 
administrative delays, so percentages previously reported for 
quarters one to three have been updated in this report. In total 
across 2021/22, 189 cases were successfully defended out of 258 
cases closed. 

5 p 4 E s 99% of audit recommendations accepted in full or part in Q4 

p G Our eurik racinas wi DS essas Na iari Goal 2 ESTN 99% 99% 98% 99% 99% bringing the average for the year to 99%. A total of 1,385 


recommendations were made during the year. 


This is an annual measure. One exit report was published in Q4, 


Positive feedback from Sandbox participants Goal 4 ele Aei Eai TA aD 91% Not Applicable] with a second due to be published in May. There were 11 
participants in the Sandbox at the end of March. 
All cases over 3 months old have now been closed in line with the 
objectives set out in our Information Access Recovery Plan. Cases 
are now being allocated and assigned more quickly than previously, 
which has had a positive impact on the efficiency and turnaround of 

: oF a ee HERE 
We will respond to 92% of Information Access Requests within Goal 4 Charter Performance 83% 79.7% 59.9% 71.0% 73.0% Red our total caseload, and our inactive caseload has reduced. We 
statutory deadlines Measure Measure expect improved compliance results from now onwards, as the 


backlog of overdue cases falls and the consequent effect of closing 
late cases will lessen in impact on our compliance rate. We 
therefore anticipate achieving our recovery target of reaching 
compliance (92%) by the end of June 2022 (Q1). 
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Number of organisations working with the Innovation Hub 


IRSP Goal 


Goal 4 


Charter 
Service 
Standard 
Measures 


Type of 
Measure 


Performance 
Measure 


performance performance performance performance 


43 


19 


43 


55 


2021/22 
Outturn 


160 


RAG Status 


Q4 Q4 Comments 


The Hub engages with businesses and public sector organisations 
(including regulators), and activities and outputs are tailored to 
each individual project. Several projects during Q4 included 
workshops and one on one sessions, resulting in a busy year-end. 
Key achievements for 2021/22 include: 

e Key supporter in DCMS led Saftey Tech Challenge. The ICO 
promoted key messages to invested stakeholders and provided 
expert data protection advice to the selected firms’ soultions 
demonstrating the art of what is possible in maintaining privacy in 
Not Applicable| end-to-end encrypted environments while also detecting Child 
Sexual Exploitation Material. 

e Continued active key mentor in the FCA Digital Sandbox providing 
FinTech organisations with specialist data protection by design 
advice to their propositions in a testing enviroment. 

e Connected places Catapult partnership established working 
collaboratively with innovators on Homes for Healthy ageing 
programme ensuring privacy considerations are at the forefront of 
developers’ minds so the Programme can realise societal benefits in 
the development of trusted solutions that respect privacy. 


70% of external DPIA requests for advice to be responded to in 8 
weeks 


Goal 6 


Charter 
Measure 


Performance 
Measure 


100% 


100% 


100% 


100% 


100% 


8 cases in total in Q1; 1 case in Q2; 3 cases in Q3; 4 cases in Q4. 


We will respond to 100% of prior consultation submissions within 
statutory timeframes 


Goal 6 


Charter 
Measure 


Performance 
Measure 


100% 


100% 


N/A 
(0 cases) 


N/A 
(1 case not 
yet due) 


100% 


2 cases in total in Q1, 1 extended due to complexity; 2 cases in 
Q2; 0 cases in Q3. We received 1 case in Q4, which is not yet due 
to be completed. 


Not Applicable 


100% of regulatory outcome fines have a recovery action plan 
within 2 working days of the debt becoming due 


Goal 5 


Performance 
Measure 


100% 


100% 


100% 


100% 


100% 


The KPI has been met in each quarter, with 32 cases across 
2021/22 (4 cases in Q1, 11 cases in Q2, 8 cases in Q3, and 9 cases 


in Q4). 


95% of investigations close within 12 months of starting. 


Goal 5 


Performance 
Measure 


90.9% 


72.4% 


71.8% 


74.2% 


80.8% 


Across 2021/22, 562 out of 696 investigations were closed within 
12 months of starting, the highest volume being Civil (195 out of 
267), Cyber (273 out of 297), Privacy and Digital Marketing 
Investigations (82 out of 96), and the Criminal Investigation Team 
closed (12 out of 36 cases). 

We have also experienced some internal challenges relating mainly 
to our legal capacity. A series of remedial actions are either 
underway or have been delivered in order to further increase legal 
resource and improve our case prioritisation process. A programme 
of work to improve investigative doctrine is also under 
development to help address quality and avoid rework on some 
files. 


We will deliver ICO role in UK adequacy process to agreed 
timetables to enable support delivery of adequacy findings 


Goal 3 


Performance 
Measure 


On target 


On target 


On target 


On target 


On target 


All timelines currently being met. 


Outcome and effectiveness of our work with 
individuals and organisations. 


Do we deliver for individuals? 


Goal 1 


Outcome 
Measure 


Our Outcome Measures are under development, following 
implementation of a research project. Questions underpinning this 
measure will encompass a range of supporting questions, to cover 
areas such as the extent to which the ICO is perceived to be 
helpful, whether our advice can be trusted, and whether individuals 
would recommend the ICO to others. 


Do we deliver for organisations? 


Goal 4 


Outcome 
Measure 


Our Outcome Measures are under development, following 
implementation of a research project. Questions underpinning this 
measure will encompass a range of supporting questions, to cover 
areas such as whether organisations would recommend the ICO, 
whether our involvement improves organisational compliance, 
whether our guidance is helpful, practical and proportionate, and 
whether our recommendations are implemented. 
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Impact and influence of the work of the ICO. 


Does the ICO uphold data rights for individuals? 


Goal 1 


Measures 


Sentiment 
Measure 


Our Sentiment Measures are under development, following 
implementation of a research project. Questions underpinning this 
measure will encompass a range of supporting questions, to cover 
areas such as whether individuals know where to get information 
on how to keep their information safe, perceptions around risks to 
their data, and what organisations should be doing to keep their 
data safe. 


Does the ICO encourage trustworthy and responsible data use by 
organisations? 


Goal 1 


Sentiment 
Measure 


Our Sentiment Measures are under development, following 
implementation of a research project. Questions underpinning this 
measure will encompass a range of supporting questions, to cover 
areas such as whether the ICO gives confidence in the way data is 
used by organisations, whether organisations know how to -and are 
trusted to - keep information safe. 


Does the ICO support and promote economic growth, competition 
and innovation? 


Goal 1 


Sentiment 
Measure 


Our Sentiment Measures are under development, following 
implementation of a research project. Questions underpinning this 
measure will encompass a range of supporting questions, to cover 
areas such as confidence in using digital services, whether the work 
of the ICO supports in building customer confidence and how data 
is looked after, as well as the ICO's support, innovation, 
international influence, and how effectively we work with others to 
reduce burdens on business. 


Key to RAG ratings* 

Green = at, or above, target 

Amber = within 10% of target 

Red = more than 10% away from target 


(*except for measures targeting ‘less than 1%‘) 
Green = at, or less than, 1% 

Amber = between 1% and 2% 

Red = greater than 2% 


